github-image-hosting

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

If the screenshot contains private information, it may be exposed through the hosted image URL for the documented retention period.

Why it was flagged

The workflow sends the selected image or screenshot to an external image-hosting provider and returns a hosted URL for embedding.

Skill content

curl -s -X POST https://img402.dev/api/free -F image=@/tmp/screenshot.png

Recommendation

Review screenshots before uploading, avoid secrets or private data, and remember the hosted link is not suitable for permanent or confidential documentation.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Running these commands can publish or modify GitHub content as the currently logged-in GitHub user.

Why it was flagged

The documented GitHub integration can edit PR descriptions or add PR/issue comments using the local gh CLI’s authenticated GitHub identity.

Skill content

gh pr edit --body ...; gh pr comment --body ...; gh issue comment 123 --body ...

Recommendation

Confirm the repository, PR or issue number, and comment/body content before using the gh commands.